GHSA-cfvv-2jvw-x2hp: Thelia before 3.2.0 Back-Office CSRF via URL Token and Unprotected Actions

Published Oct 31, 2026

Updated

Thelia before 3.2.0 contains a cross-site request forgery vulnerability in the back office that allows attackers to forge administrative actions because per-session CSRF tokens leak via URL query strings. Attackers can reuse leaked tokens or target the unprotected setToggleVisibilityAction and updatePositionAction to make logged-in administrators delete, hide or reorder catalogue and configuration objects.

Event History

Oct 31, 2026

CVE Published

via OSV·05:25 PM

Data Sourced

via OSV·05:25 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is realistically exposed to this issue?

Thelia back-office users are exposed when an administrator is logged in and can be induced to interact with an attacker-controlled request. The impact is limited to administrative actions affecting catalogue and configuration objects.

What does an attacker need to exploit it?

The attacker does not need prior privileges, but exploitation requires a logged-in administrator and user interaction. They can reuse a CSRF token leaked in a URL query string or invoke the unprotected setToggleVisibilityAction and updatePositionAction actions.

Are all administrative actions protected by CSRF controls?

No. The setToggleVisibilityAction and updatePositionAction actions are identified as unprotected, and per-session tokens can leak through URL query strings, enabling reuse for forged requests.

Which versions should be remediated?

The issue affects Thelia versions before 3.2.0. Upgrading to version 3.2.0 or later addresses the affected version range.

GHSA-cfvv-2jvw-x2hp: Thelia before 3.2.0 Back-Office CSRF via URL Token and Unprotected Actions

Event History

Frequently Asked Questions

Who is realistically exposed to this issue?

What does an attacker need to exploit it?

Are all administrative actions protected by CSRF controls?

Which versions should be remediated?

Company

Resources

Contact

Frequently Asked Questions

Who is realistically exposed to this issue?

What does an attacker need to exploit it?

Are all administrative actions protected by CSRF controls?

Which versions should be remediated?